名站网址导航为大家提供关于数据库教程相关的教程网站知识。
比如：咱们导入了某个客户的资料，咱们知道此客户的姓名是ZhangShan，咱们想知道，在咱们的业务网站数据库(eg:NorthWind)中，有哪些数据表的哪些字段设置了此姓名值ZhangShan,通过下面的SQL，咱们就可以实现此目的，此处的SQL搜索自网上，在此处做了局部修改。记一次成功的sql注入入侵检测附带sql性能网站seo优化
复制具体相关代码 具体相关代码如下:,CREATE TABLE [dbo].[my_sqllog]( [id] [bigint] IDENTITY(1,1) NOT NULL, [hit] [bigint] NULL, [sqltext],复制具体相关代码 具体相关代码如下:,public static int ExecuteSqlLog(CommandType commandType, string commandText, params DbParameter[] cm,复制具体相关代码 具体相关代码如下:
一、搜索数据是String类型
适用于搜索Text,NText,Varchar,Nvarchar,Char,NChar等类型
1、创建存储过程:My_Search_StringInGivenTable
复制具体相关代码 具体相关代码如下:
USE [NORThWIND]
GO
/****** Object: StoredProcedure [dbo].[My_Search_StringInGivenTable] Script Date: 09/25/2011 15:37:14 ******/
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
CREATE PROCEDURE [dbo].[My_Search_StringInGivenTable]
(@SearchString NVARChAR(MAX),
@Table_Schema sysname,
@Table_Name sysname)
AS
BEGIN
DECLARE @Columns NVARChAR(MAX), @Cols NVARChAR(MAX), @PkColumn NVARChAR(MAX)
-- Get all character columns
SET @Columns = STUFF((SELECT ', ' QUOTENAME(Column_Name)
FROM INFORMATION_SChEMA.COLUMNS
WhERE DATA_TYPE IN ('text','ntext','varchar','nvarchar','char','nchar')
AND TABLE_NAME = @Table_Name
ORDER BY COLUMN_NAME
FOR XML PATh('')),1,2,'')
IF @Columns IS NULL -- no character columns
RETURN -1
-- Get columns for select statement - we need to convert all columns to nvarchar(max)
SET @Cols = STUFF((SELECT ', cast(' QUOTENAME(Column_Name) ' as nvarchar(max)) as ' QUOTENAME(Column_Name)
FROM INFORMATION_SChEMA.COLUMNS
WhERE DATA_TYPE IN ('text','ntext','varchar','nvarchar','char','nchar')
AND TABLE_NAME = @Table_Name
ORDER BY COLUMN_NAME
FOR XML PATh('')),1,2,'')
SET @PkColumn = STUFF((SELECT N' ''|'' ' ' cast(' QUOTENAME(CU.COLUMN_NAME) ' as nvarchar(max))'
FROM INFORMATION_SChEMA.TABLE_CONSTRAINTS TC
INNER JOIN INFORMATION_SChEMA.CONSTRAINT_COLUMN_USAGE CU ON TC.TABLE_NAME = CU.TABLE_NAME
AND TC.TABLE_SChEMA = CU.TABLE_SChEMA
AND Tc.CONSTRAINT_NAME = CU.CONSTRAINT_NAME
WhERE TC.CONSTRAINT_TYPE ='PRIMARY KEY' AND TC.TABLE_SChEMA = @Table_Schema AND TC.TABLE_NAME = @Table_Name
ORDER BY CU.COLUMN_NAME
FOR XML PATh('')),1,9,'')
IF @PkColumn IS NULL
SELECT @PkColumn = 'cast(NULL as nvarchar(max))'
-- set select statement using dynamic UNPIVOT
DECLARE @SQL NVARChAR(MAX)
SET @SQL = 'select *, ' QUOTENAME(@Table_Schema,'''') 'as [Table Schema], ' QUOTENAME(@Table_Name,'''') ' as [Table Name]'
' from
(select ' @PkColumn ' as [PK Column], ' @Cols ' from ' QUOTENAME(@Table_Name)
' )src UNPIVOT ([Column Value] for [Column Name] IN (' @Columns ')) unpvt
WhERE [Column Value] LIKE ''%'' @SearchString ''%'''
--print @SQL
EXECUTE sp_ExecuteSQL @SQL, N'@SearchString nvarchar(max)', @SearchString
END
2、创建搜索存储过程:My_Search_String_AllTables
此存储过程将遍历指定网站数据库的所有表，并利用上面创建的存储过程My_Search_StringInGivenTable来取得每个表的搜索结果。
复制具体相关代码 具体相关代码如下:
USE [NORThWIND]
GO
/****** Object: StoredProcedure [dbo].[My_Search_String_AllTables] Script Date: 09/25/2011 15:41:58 ******/
SET ANSI_NULLS OFF
GO
SET QUOTED_IDENTIFIER OFF
GO
CREATE PROC [dbo].[My_Search_String_AllTables]
(
@SearchString NVARChAR(MAX)
)
AS
BEGIN
CREATE TABLE #RESULT ([PK COLUMN] NVARChAR(MAX), [COLUMN VALUE] NVARChAR(MAX), [COLUMN Name] sysname,
[TABLE SChEMA] sysname, [TABLE Name] sysname)
DECLARE @Table_Name sysname, @Table_Schema sysname
DECLARE curAllTables CURSOR LOCAL FORWARD_ONLY STATIC READ_ONLY
FOR
SELECT Table_Schema, Table_Name
FROM INFORMATION_SChEMA.Tables
WhERE TABLE_TYPE = 'BASE TABLE'
ORDER BY Table_Schema, Table_Name
OPEN curAllTables
FETCh curAllTables
INTO @Table_Schema, @Table_Name
WhILE (@@FETCh_STATUS = 0) -- Loop through all tables in the database
BEGIN
INSERT #RESULT
EXECUTE My_Search_StringInGivenTable @SearchString, @Table_Schema, @Table_Name
FETCh curAllTables
INTO @Table_Schema, @Table_Name
END -- while
CLOSE curAllTables
DEALLOCATE curAllTables
-- Return results
SELECT * FROM #RESULT ORDER BY [Table Name]
END
使用示例
复制具体相关代码 具体相关代码如下:
USE [NORThWIND]
GO
DECLARE @return_value int
EXEC @return_value = [dbo].[My_Search_String_AllTables]
@SearchString = N'WantValue'
SELECT 'Return Value' = @return_value
GO
还有另一个版本，就是直接创建一个存储过程来取得所要结果，但个人觉得前面那个具体相关方法更具灵活性
复制具体相关代码 具体相关代码如下:
USE [NORThWIND]
GO
/****** Object: StoredProcedure [dbo].[ZL_SearchAllTables] Script Date: 09/25/2011 15:44:10 ******/
SET ANSI_NULLS OFF
GO
SET QUOTED_IDENTIFIER OFF
GO
CREATE PROC [dbo].[ZL_SearchAllTables]
(
@SearchStr nvarchar(100)
)
AS
BEGIN
CREATE TABLE #Results (ColumnName nvarchar(370), ColumnValue nvarchar(3630))
SET NOCOUNT ON
DECLARE @TableName nvarchar(256), @ColumnName nvarchar(128), @SearchStr2 nvarchar(110)
SET @TableName = ''
SET @SearchStr2 = QUOTENAME('%' @SearchStr '%','''')
WhILE @TableName IS NOT NULL
BEGIN
SET @ColumnName = ''
SET @TableName =
(
SELECT MIN(QUOTENAME(TABLE_SChEMA) '.' QUOTENAME(TABLE_NAME))
FROM INFORMATION_SChEMA.TABLES
WhERE TABLE_TYPE = 'BASE TABLE'
AND QUOTENAME(TABLE_SChEMA) '.' QUOTENAME(TABLE_NAME) > @TableName
AND OBJECTPROPERTY(
OBJECT_ID(
QUOTENAME(TABLE_SChEMA) '.' QUOTENAME(TABLE_NAME)
), 'IsMSShipped'
) = 0
)
WhILE (@TableName IS NOT NULL) AND (@ColumnName IS NOT NULL)
BEGIN
SET @ColumnName =
(
SELECT MIN(QUOTENAME(COLUMN_NAME))
FROM INFORMATION_SChEMA.COLUMNS
WhERE TABLE_SChEMA = PARSENAME(@TableName, 2)
AND TABLE_NAME = PARSENAME(@TableName, 1)
AND DATA_TYPE IN ('char', 'varchar', 'nchar', 'nvarchar')
AND QUOTENAME(COLUMN_NAME) > @ColumnName
)
IF @ColumnName IS NOT NULL
BEGIN
INSERT INTO #Results
EXEC
(
'SELECT ''' @TableName '.' @ColumnName ''', LEFT(' @ColumnName ', 3630)
FROM ' @TableName ' (NOLOCK) '
' WhERE ' @ColumnName ' LIKE ' @SearchStr2
)
END
END
END
SELECT ColumnName, ColumnValue FROM #Results
END
[code]
二、搜索数据是Int类型
适用于搜索smallint, tinyint, int, bigint等类型
1、创建存储过程 My_Search_IntInGivenTable
[code]
USE [NORThWIND]
GO
/****** Object: StoredProcedure [dbo].[My_Search_IntInGivenTable] Script Date: 09/25/2011 15:45:46 ******/
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
CREATE PROCEDURE [dbo].[My_Search_IntInGivenTable]
(@SearchValue INT,
@Table_Schema sysname,
@Table_Name sysname)
AS
BEGIN
DECLARE @Columns NVARChAR(MAX) ,
@Cols NVARChAR(MAX) ,
@PkColumn NVARChAR(MAX) ,
@SQL NVARChAR(MAX)
--判断并创建#Result表
IF OBJECT_ID('TempDB..#Result', 'U') IS NOT NULL
DROP TABLE #Result
CREATE TABLE #RESULT
(
[PK COLUMN] NVARChAR(MAX) ,
[COLUMN VALUE] BIGINT ,
[COLUMN Name] SYSNAME ,
[TABLE SChEMA] SYSNAME ,
[TABLE Name] SYSNAME
)
--开始搜索给定的表
DECLARE curAllTables CURSOR LOCAL FORWARD_ONLY STATIC READ_ONLY
FOR
SELECT Table_Schema ,
Table_Name
FROM INFORMATION_SChEMA.Tables
WhERE Table_Name =@Table_Name
OPEN curAllTables
WhILE 1 = 1
BEGIN
FETCh curAllTables
INTO @Table_Schema, @Table_Name
IF @@FETCh_STATUS <> 0 -- Loop through all tables in the database
BREAK
PRINT ChAR(13) 'Processing ' QUOTENAME(@Table_Schema) '.'
QUOTENAME(@Table_Name)
-- Get all int columns
SET @Columns = STUFF(( SELECT ', ' QUOTENAME(Column_Name)
FROM INFORMATION_SChEMA.COLUMNS
WhERE DATA_TYPE LIKE '%int'
AND TABLE_NAME = @Table_Name
AND table_schema = @Table_Schema
ORDER BY COLUMN_NAME
FOR
XML PATh('')
), 1, 2, '')
IF @Columns IS NULL
BEGIN
PRINT 'No int columns in the ' QUOTENAME(@Table_Schema)
'.' QUOTENAME(@Table_Name)
CONTINUE
END
-- Get columns for select statement - we need to convert all columns to bigint
SET @Cols = STUFF(( SELECT ', cast(' QUOTENAME(Column_Name)
' as bigint) as '
QUOTENAME(Column_Name)
FROM INFORMATION_SChEMA.COLUMNS
WhERE DATA_TYPE LIKE '%int'
AND TABLE_NAME = @Table_Name
ORDER BY COLUMN_NAME
FOR
XML PATh('')
), 1, 2, '')
-- Create PK column(s)
SET @PkColumn = STUFF(( SELECT N' ''|'' ' ' cast('
QUOTENAME(CU.COLUMN_NAME)
' as nvarchar(max))'
FROM INFORMATION_SChEMA.TABLE_CONSTRAINTS TC
INNER JOIN INFORMATION_SChEMA.CONSTRAINT_COLUMN_USAGE CU ON TC.TABLE_NAME = CU.TABLE_NAME
AND TC.TABLE_SChEMA = CU.TABLE_SChEMA
AND Tc.CONSTRAINT_NAME = CU.CONSTRAINT_NAME
WhERE TC.CONSTRAINT_TYPE = 'PRIMARY KEY'
AND TC.TABLE_SChEMA = @Table_Schema
AND TC.TABLE_NAME = @Table_Name
ORDER BY CU.COLUMN_NAME
FOR
XML PATh('')
), 1, 9, '')
IF @PkColumn IS NULL
SELECT @PkColumn = 'cast(NULL as nvarchar(max))'
-- set select statement using dynamic UNPIVOT
SET @SQL = 'select *, ' QUOTENAME(@Table_Schema, '''')
'as [Table Schema], ' QUOTENAME(@Table_Name, '''')
' as [Table Name]' ' from
(select ' @PkColumn ' as [PK Column], ' @Cols ' from '
QUOTENAME(@Table_Schema) '.' QUOTENAME(@Table_Name)
' )src UNPIVOT ([Column Value] for [Column Name] IN ('
@Columns ')) unpvt
WhERE [Column Value] = @SearchValue'
--print @SQL -- if we get errors, we may want to print generated SQL
INSERT #RESULT
( [PK COLUMN] ,
[COLUMN VALUE] ,
[COLUMN Name] ,
[TABLE SChEMA] ,
[TABLE Name]
)
EXECUTE sp_ExecuteSQL @SQL, N'@SearchValue int', @SearchValue
PRINT 'Found ' CAST(@@ROWCOUNT AS VARChAR(10)) ' records in '
QUOTENAME(@Table_Schema) '.' QUOTENAME(@Table_Name)
END
CLOSE curAllTables
DEALLOCATE curAllTables
SELECT *
FROM #RESULT
ORDER BY [TABLE SChEMA] ,
[TABLE Name]
END
2、创建搜索存储过程My_Search_Int_AllTables,与上面类似，此存储过程将调用 My_Search_IntInGivenTable来实现所遍历的每一个数据表的搜索结果
复制具体相关代码 具体相关代码如下:
关于数据库教程相关的教程网站知识今天我们就说到这里了，希望可以帮到大家。
